DragonFlyBSD Kernel Audit
← triage · dashboard
DF-2871

taskqueue_start_threads() swallows lwkt_create failures and always returns 0 (mirror of DF-2850 in subr_taskqueue.c)

Field Value
ID DF-2871
Status new
Severity Low
CVSS 3.1 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE CWE-754 Improper Check for Exceptional Conditions
File sys/kern/subr_taskqueue.c
Lines 594-606
Area kern
Confidence certain
Discovered 2026-09-02
Pass 2 (GLM 5.3 second pass)
Bucket base:kern
Reported pending
Known CVE none
CVE match novel

Summary

On lwkt_create error the loop kprintf's, NULLs the slot and continues, then unconditionally return 0. Total failure yields an unrunnable queue whose enqueues still succeed — every future taskqueue_drain on it sleeps forever (ta_pending never clears, no waker); partial failure silently degrades. Same defect class as DF-2850 (gtaskqueue) — this is the subr_taskqueue.c sibling. Fix: track the error, and on tq_tcount==0 free tq_threads and return it so callers abort.

Timeline

  • 2026-09-02 Discovered during pass-2 audit of subr_taskqueue.c (GLM 5.3).

Discussion (0)

No comments yet.